feat(cli): change --list-all-pkgs default to true

[knqyf263]

Description

This PR changes the default value of the --list-all-pkgs flag from false to true to better align with the growing focus on supply chain security and SBOM (Software Bill of Materials) generation.

Background

While Trivy has traditionally focused on vulnerability detection, the increasing emphasis on supply chain security has created a stronger need for comprehensive package listings and SBOM generation. Users increasingly want to see all packages in their scans, not just those with vulnerabilities.

Problems with Current Behavior

The current default (--list-all-pkgs=false) creates several UX issues:

• To use trivy convert, users must explicitly specify --format json --list-all-pkgs
• This is unintuitive and adds friction to common workflows
• Many users expect package lists to be complete by default

Solution

By changing the default to true:

• The behavior becomes more intuitive for modern use cases
• Users get comprehensive package information by default
• Those who want the old behavior can still use --list-all-pkgs=false

Before and After Examples

Before (current behavior)

# Must explicitly specify --list-all-pkgs for complete package lists
$ trivy image --format json --list-all-pkgs -o result.json debian:11
$ trivy convert --format cyclonedx --output result.cdx result.json

# Without --list-all-pkgs, JSON output only includes packages with vulnerabilities
$ trivy image --format json -o result.json debian:11  # Incomplete package list

After (with this PR)

# All packages included by default
$ trivy image --format json -o result.json debian:11
$ trivy convert --format cyclonedx --output result.cdx result.json

# Can still exclude packages without vulnerabilities if needed
$ trivy image --format json --list-all-pkgs=false -o result.json debian:11

Warning Behavior

The warning for using --list-all-pkgs with non-JSON formats now only appears when explicitly set by the user:

Before: Warning shown when explicitly using --list-all-pkgs

$ trivy image debian:11  # No warning (default was false)
$ trivy image --list-all-pkgs debian:11  # Shows warning about --list-all-pkgs being ignored

After: Warning only when explicitly set (even though default is now true)

$ trivy image debian:11  # No warning (using default true, but not explicitly set)
$ trivy image --list-all-pkgs=true debian:11  # Shows warning (explicitly set)

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[Copilot]

Pull Request Overview

This PR changes the default value of the --list-all-pkgs flag from false to true to align with modern supply chain security practices and improve the user experience for SBOM generation workflows.

• Changes the default behavior to include all packages in JSON reports by default
• Updates warning logic to only show when the flag is explicitly set by users
• Modifies test cases and documentation to reflect the new default behavior

Reviewed Changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.

File	Description
pkg/flag/report_flags.go	Sets default value to true and updates warning logic to check if flag was explicitly set
pkg/commands/app.go	Removes --list-all-pkgs from convert command example
integration/*.go	Updates test helper functions to use --list-all-pkgs=false when needed
docs/**/*.md	Updates CLI documentation and examples to reflect new default value

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[DmitriyLewen]

LGTM.

For the latest packages that I added, I tried to use the --list-all-pkgs flag so that we can verify both package detection and vulnerabilities (when available).
But for other packages, this flag is usually disabled.
I think we should update the test data, and leave only a few examples with --list-all-pkgs=false.
But this should be done in a separate PR.

[knqyf263]

I think we should update the test data, and leave only a few examples with --list-all-pkgs=false.

Currently, tests such as the package list are covered by fanal's integration tests. If we want to run tests on the Trivy side with --list-all-pkgs enabled, integration with fanal will likely be necessary. Otherwise, the tests will be duplicated. We can discuss it later.